build: add safe toolchain cleanup and recovery

docs/implementation-plan.v1.md

@@ -190,7 +190,7 @@ scripts/test-unit                 [--package PATTERN] [--run REGEXP] [--race]
 scripts/test-integration          [--suite NAME|all] [--run-id ID] [--resume]
 scripts/test-e2e                  [--scenario NAME|all] [--run-id ID] [--resume]
 scripts/test-env                  doctor|coverage|status|logs|collect|recover|reuse|stop|reset|purge|gc ...
-scripts/build                     build|verify (pinned toolchain; host-safe)
+scripts/build                     build|verify|doctor|recover|clean (pinned toolchain; host-safe)
 scripts/windows/build-test-bundle --run-id ID --config FILE [--ca FILE]
 scripts/windows/test-host         status|prepare|stage|run|collect|stop|reset|recover
 ```
@@ -208,6 +208,13 @@ exact `.test-runs/<run-id>` directory, with source-commit and SHA-256 manifest;
 it refuses replacement rather than overwriting an earlier bundle. This is not a
 release publisher: signing, version resources, and public checksum publication
 remain Phase 8 gates.
+It must report the exact RVBox toolchain image/cache/artifact footprint and
+provide a dry-run-first cleanup that can remove only the ignored `bin/` output,
+the exact toolchain image, and its two named Go-cache volumes. Cleanup requires
+`--execute` plus interactive confirmation (or CI `--yes`), refuses images used
+by containers, never touches `.test-runs/`, and never invokes a global Docker
+prune. `scripts/build recover` must rebuild the toolchain image and binaries
+after any or all of those owned resources were cleared.
 
 The first integration/E2E invocation creates a filesystem-safe random run ID,
 or validates an explicitly supplied one, and records

docs/testing.md

@@ -21,6 +21,22 @@ Build all supported binaries without installing `make` or Go on the host:
 scripts/build build
 ```
 
+`scripts/build doctor` reports the exact owned builder image, Go cache volumes,
+and ignored `bin/` artifact directory. To reclaim space, cleanup is dry-run by
+default and never performs a global Docker prune:
+
+```sh
+scripts/build clean --all
+scripts/build clean --all --execute --yes
+scripts/build recover
+```
+
+The second command removes only `bin/`, `rvbox-dev-toolchain:latest`, and the
+two named RVBox Go-cache volumes. `recover` rebuilds the pinned toolchain and
+all binaries from source. It intentionally does not remove `.test-runs/`, which
+may contain resumable environments; use the exact-run `scripts/test-env purge`
+workflow for those.
+
 For a native Windows run, create the immutable per-run test bundle with the
 pinned toolchain. Supply a test-specific config whose endpoint and CA path are
 valid for that run; the command refuses to replace an existing bundle.